Development May 2022

development@lists.ipfire.org

11 participants
84 discussions

Re: ipblocklist - conflict with location update
by Charles Brown 02 May '22

02 May '22

Hi Stefan, Tim, Rob I manually updated my location database at ssh shell prompt with command, update-location-database. It appears to present some possible conflicts. Or perhaps, is this purely informational? See following. -Charles ----------------------------------------------------------------------------------------------------------------------------------------- [root@ipfire ~]# update-location-database Downloaded new database from Mon, 18 Apr 2022 05:52:42 GMT Reloading firewall ipset v7.11: Error in line 3: Set cannot be created: set with the same name already exists ERROR: ipset restore -f /var/lib/ipblocklist/BLOCKLIST_DE.conf ipset v7.11: Error in line 3: Set cannot be created: set with the same name already exists ERROR: ipset restore -f /var/lib/ipblocklist/BOGON_FULL.conf ipset v7.11: Error in line 3: Set cannot be created: set with the same name already exists ERROR: ipset restore -f /var/lib/ipblocklist/EMERGING_COMPROMISED.conf ipset v7.11: Error in line 3: Set cannot be created: set with the same name already exists ERROR: ipset restore -f /var/lib/ipblocklist/FEODO_AGGRESIVE.conf ipset v7.11: Error in line 3: Set cannot be created: set with the same name already exists ERROR: ipset restore -f /var/lib/ipblocklist/SHODAN.conf ipset v7.11: Error in line 3: Set cannot be created: set with the same name already exists ERROR: ipset restore -f /var/lib/ipblocklist/SPAMHAUS_EDROP.conf ipset v7.11: Error in line 3: Set cannot be created: set with the same name already exists ERROR: ipset restore -f /var/lib/ipblocklist/TOR_ALL.conf [ OK ]

3 3

Missing conf call link
by Adolf Belka 02 May '22

02 May '22

Hi All, There is no jitsi conf call link in the wiki conf call page for May 2nd. Adolf -- Sent from my laptop

2 1

[PATCH] gcc: Update mpfr with patches for use in toolchain build
by Adolf Belka 02 May '22

02 May '22

- Added mpfr consolidated patches file to mpfr in gcc. mpfr is built internally for use in the toolchain. - Confirmed working by running./make toolchain which ran successfully confirmed from the _build.toolchain.log file that the patches were successfully implemented for gcc pass 1, gcc pass L and gcc pass 2 - Full toolchain build successfully completed. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/gcc | 1 + 1 file changed, 1 insertion(+) diff --git a/lfs/gcc b/lfs/gcc index 5ce29a13d..1d9d172c2 100644 --- a/lfs/gcc +++ b/lfs/gcc @@ -250,6 +250,7 @@ ifeq "$(TOOLCHAIN)" "1" cd $(DIR_APP) && tar xfa $(DIR_DL)/gmp-$(GMP_VER).tar.xz cd $(DIR_APP) && mv -v gmp-$(GMP_VER) gmp cd $(DIR_APP) && tar xfa $(DIR_DL)/mpfr-$(MPFR_VER).tar.xz + cd $(DIR_APP)/mpfr-$(MPFR_VER) && patch -Np1 < $(DIR_SRC)/src/patches/mpfr-4.1.0-cumulative-patches-1-to-13.patch cd $(DIR_APP) && mv -v mpfr-$(MPFR_VER) mpfr cd $(DIR_APP) && tar xfa $(DIR_DL)/mpc-$(MPC_VER).tar.gz cd $(DIR_APP) && mv -v mpc-$(MPC_VER) mpc -- 2.36.0

2 1

[PATCH] pcengines-apu-firmware: Update to version 4.16.0.2
by Jon Murphy 02 May '22

02 May '22

- Update from 4.15.0.1 to 4.16.0.2 - Update of rootfile - Changelog v4.15.0.2 - Release date: 2022-01-11 rebased with official coreboot repository commit 3990da0b disabled SMM enabled parallel AP initialization for apu2-6 for faster boot time v4.15.0.3 - Release date: 2022-02-16 Rebased with official coreboot repository commit 36425312ee Added checking hardware matrix before regression tests Fixed the hard disk not visible in the Seabios Boot Menu v4.16.0.1 - Release date: 2022-03-08 Rebased with official coreboot repository commit b4ba289fa5 Disabled loglevel prefixes introduced in coreboot 4.16 Disabled ANSI escape sequences introduced in coreboot 4.16 Fixed AMD PSP CCP as entropy source v4.16.0.2 - Release date: 2022-03-29 Rebased with official coreboot repository commit 66f99f7fa7 Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- .../rootfiles/packages/pcengines-apu-firmware | 12 ++++++------ lfs/pcengines-apu-firmware | 17 +++++++++-------- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/config/rootfiles/packages/pcengines-apu-firmware b/config/rootfiles/packages/pcengines-apu-firmware index de4f03efa..b32bd2f3c 100644 --- a/config/rootfiles/packages/pcengines-apu-firmware +++ b/config/rootfiles/packages/pcengines-apu-firmware @@ -1,8 +1,8 @@ #lib/firmware/pcengines #lib/firmware/pcengines/apu -lib/firmware/pcengines/apu/apu1_v4.15.0.1.rom -lib/firmware/pcengines/apu/apu2_v4.15.0.1.rom -lib/firmware/pcengines/apu/apu3_v4.15.0.1.rom -lib/firmware/pcengines/apu/apu4_v4.15.0.1.rom -lib/firmware/pcengines/apu/apu5_v4.15.0.1.rom -lib/firmware/pcengines/apu/apu6_v4.15.0.1.rom +lib/firmware/pcengines/apu/apu1_v4.16.0.2.rom +lib/firmware/pcengines/apu/apu2_v4.16.0.2.rom +lib/firmware/pcengines/apu/apu3_v4.16.0.2.rom +lib/firmware/pcengines/apu/apu4_v4.16.0.2.rom +lib/firmware/pcengines/apu/apu5_v4.16.0.2.rom +lib/firmware/pcengines/apu/apu6_v4.16.0.2.rom diff --git a/lfs/pcengines-apu-firmware b/lfs/pcengines-apu-firmware index d919675e8..221cec303 100644 --- a/lfs/pcengines-apu-firmware +++ b/lfs/pcengines-apu-firmware @@ -26,14 +26,14 @@ include Config SUMMARY = Firmware files for PC Engines apu system boards -VER = 4.15.0.1 +VER = 4.16.0.2 THISAPP = pcengines-apu-firmware-$(VER) DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = pcengines-apu-firmware -PAK_VER = 10 +PAK_VER = 11 SUP_ARCH = x86_64 DEPS = firmware-update @@ -59,12 +59,12 @@ apu4_v$(VER).rom = $(DL_FROM)/apu4_v$(VER).rom apu5_v$(VER).rom = $(DL_FROM)/apu5_v$(VER).rom apu6_v$(VER).rom = $(DL_FROM)/apu6_v$(VER).rom -apu1_v$(VER).rom_BLAKE2 = 317bf51d82c1c99514d3dc3d6324e8f6c6b4768f2052902673a21fbdb554f6602940dbd531a80074a00ca9777d72bd8772deac5be2e4df38c8675e1d67d426ee -apu2_v$(VER).rom_BLAKE2 = eaa5fa9bf1b0f1439b41cc2d48e0db24fb3e1096419ca728c98644d43a5bf0164380ab7173cbcbcf14b38052128c4b6c0bd8032e65f12c6f79262801fc534875 -apu3_v$(VER).rom_BLAKE2 = 11af9de100d7da62edd585c1327325cdd661eafc1e540f9395728ee47e35acf427348b29e011f5269e86ab6d6923f7e2a47b59cdf7d5a982cbe4328abc10652c -apu4_v$(VER).rom_BLAKE2 = bf57beb63cd7581d6d3f24e2c6f51f15c540dc99036a2ccc22ecf9e3fbc8f37bf5bc46bb96fa9f854b952aa9a09130d7096f0a3c372b040cfcfc2abbf644c428 -apu5_v$(VER).rom_BLAKE2 = e296e2e168be85220f22e00d7cd075c73660f18ffb28b26a16c01129f77e2ed50148b3c95405945bcacdebf9d6e4e76ef08ffcef362898c46a381453844d9606 -apu6_v$(VER).rom_BLAKE2 = d6ce353299499be201af03ee678aa8bf3e33bdc2c9c952e91242b67febf9678bb85b6f6ed1b7d7b4278f5921cadb306451603d6c59bdf45d70793faf2c26312b +apu1_v$(VER).rom_BLAKE2 = 8fa47b6f3bd947fbf1bd8753c0362669b2bab6ee7a041d2fac736de3a8633f352af7e92cf30aa41f625194a585489d16fa1cfbcfce4d750d232adf6f39371e5d +apu2_v$(VER).rom_BLAKE2 = 3cfd0d8c6cd2c9ac9613fb30dddd8f7522287bed5ff296a54549b13a29549af331af6a82e1957b976633056b8c40f9fdde7ba237726be44241e21658bbc3c379 +apu3_v$(VER).rom_BLAKE2 = 75fc179a3e862f09ea38cf2db5bdbe6f46a09711f10f73ff2e5587c28a38cb697fb76f02ee4f644e932656d53240437c3669babe322a9c746bcb71d3128013f2 +apu4_v$(VER).rom_BLAKE2 = fe8993c073cf1656e21884f1ed4ce2cbb01e141bed56dc6e4e8e3ab0f731eb9857e2c7b86a127ea51653a17d10b4a67b01a666f87004b8b6d09d1dd205aea8de +apu5_v$(VER).rom_BLAKE2 = 9effda771c61051c759dc8d1dabb8a357748a0788542e4397ad24b7ae1d3f9852b0695f7f5ac05f461dbc21588f7e94cbc80e70fc9ec0b9d8a60c0939bff0b91 +apu6_v$(VER).rom_BLAKE2 = f7dfa3e34edba3fb493080097b686bd6bdf97b939d9b7287c9973e33eabc6f878cbb3e68d29e7f1b8284a2357a338861f22d3c3741b288a8b6e7a8a7ba42736f install : $(TARGET) @@ -103,3 +103,4 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) /lib/firmware/pcengines/apu @$(POSTBUILD) + \ No newline at end of file -- 2.30.2

3 5

[PATCH] Tor: Update to 0.4.7.7
by Peter Müller 01 May '22

01 May '22

Please refer to https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.7.7 for the changelog of this version. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tor b/lfs/tor index 259b9564c..e6751fb84 100644 --- a/lfs/tor +++ b/lfs/tor @@ -26,7 +26,7 @@ include Config SUMMARY = Anonymizing overlay network for TCP (The onion router) -VER = 0.4.6.10 +VER = 0.4.7.7 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 68 +PAK_VER = 69 DEPS = libseccomp @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4bdf8ab8ac992866ffc18711de0ad9e19b496398dfdace4d3902273822666dcfda3acd825ee22251cd8d671ff563702c6f24fe8670719a2c75d144cfe9219f68 +$(DL_FILE)_BLAKE2 = 18acfbe017b2ad456184f6031881149717f6fecad0d3e6daf90241a5a8ef296c32a36ace266d38b703f34b66d71e282c803f03f2059502c6ff6f4fdfb6641a97 install : $(TARGET) -- 2.34.1

2 1

[PATCH] sysctl: Use strict Reverse Path Filtering
by Peter Müller 01 May '22

01 May '22

The strict mode, as specified in RFC 3704, section 2.2, causes packets to be dropped by the kernel if they arrive with a source IP address that is not expected on the interface they arrived in. This prevents internal spoofing attacks, and is considered best practice among the industry. After a discussion with Michael, we reached the conclusion that permitting users to configure the operating mode of RPF in IPFire causes more harm than good. The scenarios where strict RPF is not usable are negligible, and the vast majority of IPFire's userbase won't even notice a difference. This supersedes <495b4ca2-5a4b-2ffa-8306-38f152889582(a)ipfire.org>. Suggested-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/etc/sysctl.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 5fc3e3d89..7fe397bb7 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -12,13 +12,13 @@ net.ipv4.tcp_syn_retries = 3 net.ipv4.tcp_synack_retries = 3 net.ipv4.conf.default.arp_filter = 1 -net.ipv4.conf.default.rp_filter = 2 +net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.default.log_martians = 1 net.ipv4.conf.all.arp_filter = 1 -net.ipv4.conf.all.rp_filter = 2 +net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.all.log_martians = 1 -- 2.34.1

2 1

[PATCH] Do not permit world-readability of /etc/sudoers.d/
by Peter Müller 01 May '22

01 May '22

Lynis (rightly) complains about this directory and its contents being world-readable on current IPFire installations. Since there is no necessity for this, we might as well chmod them to 750 / 640. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/logwatch | 4 ++-- lfs/setup | 4 ++++ lfs/zabbix_agentd | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/lfs/logwatch b/lfs/logwatch index 26da2c62e..8631f4541 100644 --- a/lfs/logwatch +++ b/lfs/logwatch @@ -106,8 +106,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) ln -vsf /usr/share/logwatch/default.conf /etc/logwatch/conf -mkdir -p /etc/sudoers.d - chmod -v 755 /etc/sudoers.d - install -v -m 644 $(DIR_SRC)/config/logwatch/sudoers/logwatch-mdadm \ + chmod -v 750 /etc/sudoers.d + install -v -m 640 $(DIR_SRC)/config/logwatch/sudoers/logwatch-mdadm \ /etc/sudoers.d/logwatch-mdadm @rm -rf $(DIR_APP) diff --git a/lfs/setup b/lfs/setup index 5779406ef..82286d6a0 100644 --- a/lfs/setup +++ b/lfs/setup @@ -58,5 +58,9 @@ $(TARGET) : --with-config-root="$(CONFIG_ROOT)" cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install + + # Fix file permissions of /etc/sudoers.d/setup + chmod 640 /etc/sudoers.d/setup + @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd index c44f2b5f5..63566c1a7 100644 --- a/lfs/zabbix_agentd +++ b/lfs/zabbix_agentd @@ -113,7 +113,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(call INSTALL_INITSCRIPTS,$(SERVICES)) # Install sudoers include file - install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/sudoers \ + install -v -m 640 $(DIR_SRC)/config/zabbix_agentd/sudoers \ /etc/sudoers.d/zabbix # Install include file for backup -- 2.34.1

2 1

[PATCH] cups: for now cups make a backup on uninstall
by Daniel Weismueller 01 May '22

01 May '22

and a restore on install / update The include file that was added in a previous commit allowed to manually create a backup, but none was created when the addon was installed, uninstalled or updated. Signed-off-by: Daniel Weismueller <daniel.weismueller(a)ipfire.org> --- src/paks/cups/install.sh | 1 + src/paks/cups/uninstall.sh | 1 + 2 files changed, 2 insertions(+) diff --git a/src/paks/cups/install.sh b/src/paks/cups/install.sh index b3f0f1368..cc5866971 100644 --- a/src/paks/cups/install.sh +++ b/src/paks/cups/install.sh @@ -23,6 +23,7 @@ # . /opt/pakfire/lib/functions.sh extract_files +restore_backup "${NAME}" /etc/init.d/messagebus reload start_service --delay 300 --background ${NAME} ln -svf ../init.d/cups /etc/rc.d/rc0.d/K00cups diff --git a/src/paks/cups/uninstall.sh b/src/paks/cups/uninstall.sh index 01b13de76..d4abdde63 100644 --- a/src/paks/cups/uninstall.sh +++ b/src/paks/cups/uninstall.sh @@ -23,6 +23,7 @@ # . /opt/pakfire/lib/functions.sh stop_service ${NAME} +make_backup "${NAME}" remove_files rm -rf /etc/rc.d/rc*.d/*cups /etc/init.d/messagebus reload -- 2.35.1

2 1

[PATCH 1/3] sarg: Force update to get new libgd library
by Adolf Belka 01 May '22

01 May '22

Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sarg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/sarg b/lfs/sarg index b75d185ed..d38933fb0 100644 --- a/lfs/sarg +++ b/lfs/sarg @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = sarg -PAK_VER = 5 +PAK_VER = 6 DEPS = -- 2.36.0

1 2

[PATCH] minidlna: Addition of patches to fix CVE-2022-26505
by Adolf Belka 01 May '22

01 May '22

- CVE-2022-26505 A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files. CVE created on 6th March 2022 - minidlna have created the patches to fix CVE-2022-26505 and have created a git tag for version 1.3.1 but have not provided any 1.3.1 source tarballs. A ticket was raised on 14th March 2022 in the source forge support system asking to "Please publish a tarball for 1.3.1" but there was no reply from the developer so far. - In the NIST National Vulnerability Database it refers to a fix implemented in 1.3.1 but the link to the sourceforge page is only the patches applied for the fix - I used those diff descriptions to create a patch to implement on the existing 1.3.0 version in IPFire and this patch submission applies that fix - Incremented the lfs PAK_VER Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/minidlna | 3 +- ...x-DNS-rebinding-issue-CVE-2022-26505.patch | 44 +++++++++++++++++++ 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-26505.patch diff --git a/lfs/minidlna b/lfs/minidlna index 17cf76339..0fa7aec96 100644 --- a/lfs/minidlna +++ b/lfs/minidlna @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = minidlna -PAK_VER = 8 +PAK_VER = 9 DEPS = ffmpeg flac libexif libid3tag libogg @@ -84,6 +84,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) $(UPDATE_AUTOMAKE) + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-26505.patch cd $(DIR_APP) && ./configure --prefix=/usr cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && make install diff --git a/src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-26505.patch b/src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-26505.patch new file mode 100644 index 000000000..c28425811 --- /dev/null +++ b/src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-26505.patch @@ -0,0 +1,44 @@ +--- minidlna-1.3.0/upnphttp.c.orig 2020-11-24 19:53:50.000000000 +0100 ++++ minidlna-1.3.0/upnphttp.c 2022-04-30 12:59:23.432073807 +0200 +@@ -273,6 +273,11 @@ + p = colon + 1; + while(isspace(*p)) + p++; ++ n = 0; ++ while(p[n] >= ' ') ++ n++; ++ h->req_Host = p; ++ h->req_HostLen = n; + for(n = 0; n < n_lan_addr; n++) + { + for(i = 0; lan_addr[n].str[i]; i++) +@@ -909,6 +914,18 @@ + } + + DPRINTF(E_DEBUG, L_HTTP, "HTTP REQUEST: %.*s\n", h->req_buflen, h->req_buf); ++ if(h->req_Host && h->req_HostLen > 0) { ++ const char *ptr = h->req_Host; ++ DPRINTF(E_MAXDEBUG, L_HTTP, "Host: %.*s\n", h->req_HostLen, h->req_Host); ++ for(i = 0; i < h->req_HostLen; i++) { ++ if(*ptr != ':' && *ptr != '.' && (*ptr > '9' || *ptr < '0')) { ++ DPRINTF(E_ERROR, L_HTTP, "DNS rebinding attack suspected (Host: %.*s)", h->req_HostLen, h->req_Host); ++ Send404(h);/* 403 */ ++ return; ++ } ++ ptr++; ++ } ++ } + if(strcmp("POST", HttpCommand) == 0) + { + h->req_command = EPost; +--- minidlna-1.3.0/upnphttp.h.orig 2020-11-24 19:53:50.000000000 +0100 ++++ minidlna-1.3.0/upnphttp.h 2022-04-30 13:00:22.619152312 +0200 +@@ -89,6 +89,8 @@ + struct client_cache_s * req_client; + const char * req_soapAction; + int req_soapActionLen; ++ const char * req_Host; /* Host: header */ ++ int req_HostLen; + const char * req_Callback; /* For SUBSCRIBE */ + int req_CallbackLen; + const char * req_NT; -- 2.36.0

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development May 2022